haunt[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

haunt.dll
Size

90KB
MD5

bc2aab512a886e0965cc5c84d034f70f
SHA1

ab24a7a7bfd1bc72b67256ca0f4022b8367c4a55
SHA256

407a7854e8bacd2dbf187cfbfc5923c3767c132e4b95b0fbbb2d554b8af72be1
SHA512

9ed7475a591fc9867db0da1f7e0d61fb1254535bac7c9a3b15ad1e57d819b5156496c709346998d99b66d55b0f24788d4a0425dec1b23575f1b3a23e04b39597
SSDEEP

1536:aj8etE7mHWY0xORtVpB5NY223akt8RXxeRD3AuwfWCaJWRaAzrQnpXwEETiB2+hP:MFj+8nuwfbahAnIQCJkk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
haunt.dll

Files

haunt.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Admin\Desktop\iis.Stupid.Template-1.3\iis.Stupid.Template-1.3\obj\Debug\netstandard2.1\haunt.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ